1. Field of the Invention
The present invention relates to methods for authenticating users (terminals in data networks) and the assignment of addresses to terminals which access data networks.
2. Description of the Prior Art
The dynamic host configuration protocol (DHCP) proposes authentication (auth) extension to guarantee that only authorized users have access to a packet data network (IP networks). The service provider network providing connectivity for a user to a packet data network has to authenticate the user (wireless terminal) during the network registration and address allocation procedure. Typically, mobile networks utilize a dynamic addressing scheme which is implemented using the DHCP protocol to connect users to network devices which connect the user to the packet data network. However, it should be understood that utilization of the DHCP protocol is not limited to wireless networks. The DHCPv4 and the DHCPv6 protocols enable dynamic configuration of IP addresses and options and use the User Data Protocol (UDP) as the communication protocol. The network entities utilized in the DHCPv4 and DHCPv6 protocols are the server, the user and an optional relay. The server is the entity that distributes network addresses and information to the users. The optional relay provides forwarding of DHCP messages so that one DHCP server serves many subnetworks instead of one server being assigned to each subnetwork. All communications between the DHCP user and the DHCP server take place utilizing a request-reply style message exchange. All DHCP messages may also contain one or more options (DHCPv4)/extensions (DHCPv6) that carry additional useful parameters between the DHCP user and server.
The communications involved with the DHCPv4 protocol are illustrated in FIG. 1. While not illustrated, an optional relay may be used to forward DHCP messages so that the server serves plural subnetworks. When a DHCPv4 user connects to a network and wishes to acquire an IPv4 address and other work information, it first broadcasts a DHCP discover message to the network in order to discover the presence of any DHCP server which may provide connectivity of the user to a packet data network. The user receives a DHCP offer message from all of the servers that received its DHCP discover message which were configured to answer to the user. The DHCP offer message includes the server""s IP address and all other network information which the server assumes the user will need. The user selects the DHCP server whose DHCP offer message is the first one received and discards the rest. The user informs the server whose DHCP offer message was accepted with a DHCP request transmitted to the server to begin the user""s use of the IP address. The server acknowledges the request by sending the DHCP acknowledgment to the user which then may start using the assigned IP address.
Whenever the user wants to deallocate its IP address, it sends a DHCP release message to the server. After the DHCP release message, the user may not use the IP address any more. If the user needs to use the address for a longer time than that was specified, the user has to try to renew the use of the assigned IP address. This has to be done no later than when half of the specified time allocated to the user has been used to have the address renewed. The user renews the address by sending a new DHCP request message to the DHCP server. If the server accepts the renewal of the IP address, it sends a DHCP acknowledgment containing new timer values to the user. The server may also deny the renewal of the address by sending a DHCP non-acknowledgment to the user which forces the user to immediately stop using the IP address and revert to an initial state where restarting of the DHCP address acquisition process and authentication begins. If the server does not respond, the user has the option of sending all of the DHCP servers a DHCP request message that includes the user""s IP address. Any DHCP server that is configured to provide the IP address to the user may either renew the address by sending a DHCP acknowledgment or deny the address with a DHCP non-acknowledgment. If no replies are sent, the user stops using the IP address when the timer expires and has thereafter to restart the DHCP protocol from the initial state.
The communications involved with the DHCPv6 protocol are illustrated in FIG. 2. When a user contacts the network, it will first generate a link-local IPv6 address according to the rules of stateless auto configuration as described in RFC 2462 which specifications are incorporated herein by reference in their entirety. Thereafter, the user will receive a router advertisement and if the router advertisement tells the user to use stateful auto configuration, (i.e. DHCPv6), the user will send a DHCP solicit message to all DHCP agents multicast address to obtain one or more DHCP server addresses. The solicit message may be forwarded by a DHCP relay to the all-DHCP-server multicast address of another network. If the user has been preconfigured with the IP address of a server or a relay and the server or relay is on the same network link as the user, the user may skip the solicit message and select the DHCP protocol with the request message. A DHCP server receiving the solicit message will respond with DHCP advertisement message to inform the user about the server. The advertisement message contains a preference field that informs how interested the server is in serving the particular user. If the user and the server are on the same link, the server replies directly to the user, otherwise, the advertised message is sent by the same DHCP relay that forwarded the solicit message to the server.
The user waits a predefined amount of time so that it has a chance to receive the DHCP advertisement messages from different servers. The DHCP user makes the selection between the DHCP servers based on the preference value by selecting the server that specifies the highest value of interest. If the user receives an advertisement message with the maximum preference value of 255, it may select the respective server immediately and ignore any later received advertisement messages.
The user sends a DHCP address request message to the server it selected in order to request the network configuration parameters from the server. The user requests these parameters by adding an extension concerning those parameters to the request message. By setting the xe2x80x98Cxe2x80x99 bit field in the request message, the user may request a deallocation of its resources except those explicitly listed in the extensions. By setting the xe2x80x98Rxe2x80x99 bit field, the user requests a deallocation of all of the resources it had previously required. These deallocation requests are very useful when a user restarts because the user may have lost some or all of its previous state in the restarting process. The request message contains a transaction ID field which is a monotonically increasing unsigned integer number that is used to identify the request message and combines it with the DHCP reply.
The server sends one DHCP reply message in response to every received DHCP request message. The reply message carries all the important network information as message extensions which provides flexibility to information exchange. The transaction ID field is copied from the request message in order to associate the reply message with the correct request.
Whenever the DHCP user wants to deallocate some parameters it has received, it may do so by sending a DHCP release message directly to the server. The parameters that are to be released are listed as extensions. A release message without extension causes the server to release all the resources the user has acquired. Releasing parameters using the release message is preferable to the aforementioned xe2x80x98Cxe2x80x99 and xe2x80x98Rxe2x80x99 bit fields in the request message which should only be used for cleaning up user parameters at start time.
Servers may notify the users that some of their parameters need to be updated by sending a DHCP reconfigure message. The parameters which are present in the reconfigured messages extensions have to be reacquired by the user. In order to receive the new parameters, the user sends a new request message to the server which then responds with a reply message containing the parameters. See xe2x80x9cDynamic Host Configuration Protocol For IPv6 (DHCPv6) Work in Progress DHCP Working Group 1998xe2x80x9d, J. Bound and C. Perkins and xe2x80x9cExtensions for the Dynamic Host Configuration Protocol for IPv6 Work in Progress 1998xe2x80x9d, by C. Perkins which publications are incorporated herein by reference in their entirety.
The GSM (Global System for Mobile Communications) telephone system uses algorithms in the mobile user units and in the network servers which control authentication of the user to prevent unauthorized access to the network and to provide encryption of the transmissions between the terminal and networks. The GSM System is described in depth in the publication, xe2x80x9cThe GSM System for Mobile Communicationsxe2x80x9d by Mouly and Pautet, Copyright 1992, which publication is incorporated herein by reference in its entirety. Authentication in a GSM network is performed by the generation of a signed response SRES by both the user mobile and the network which is a function of a unique secret identifier Ki of the user mobile and a random number RAND. The signed response SRES is calculated in the subscriber identification module (SIM) based upon Ki stored inside SIM and a random number RAND obtained from the network authentication center (AuC). Additionally, the user mobile and the network each perform encryption by generating a key Kc, which is a function of the same random number RAND and the secret identifier Ki of the mobile. The first authentication algorithm, which calculates SRES, is known as the A3 algorithm and the second algorithm, which computes Kc, which is computed each time a user mobile is authenticated, is known as the A8. However, each of the operations of authentication and computing of the ciphering key Kc requires the mobile to be programmed to perform the aforementioned computations and the secret algorithm stored in SIM.
The present invention is a method by which a user utilizes a single mechanism for the dual functions of obtaining an IP address in a data network, which preferably is a packet data network or a wireless LAN network and authentication in the network providing connectivity to the data network. The authentication mechanism in a first embodiment utilizes a user identification stored in a second network providing connectivity between the user and the first network which may be obtained from a smart card in the user terminal. Alternatively, in second and third embodiments, the authentication mechanism uses a user identification stored in the first network. The user identification in the second and third embodiments, like the first embodiment, may be obtained from a smart card in the user terminal. The invention permits a wireless data network to authenticate the user using the user""s telephone authentication information. The invention permits telephone networks to sell internet service provider (ISP) network access to customers and handle all billing in a telephony bill. In this situation, the ISP operator provides a gateway and the user""s authentication is relayed to the telephone network which is the manner in which cellular (for example, GSM) authentication is adapted to data networks. Utilization of a smart card approach which, in a preferred embodiment, uses SIM for authentication and billing, which also handles charges for packet data network access.
The use of the smart card permits the mapping of a telephone interface into a wireless IP network terminal and to charge wireless internet services to the telephone bill. A user entering a wireless internet office may utilize their smart card used in the telephone terminal and insert the smart card into a WLAN terminal. This permits evolution from telephone based services to WLAN based wireless internet services while maintaining interworking with the telephone operator. Similarly, the use of the smart card may be integrated into data network authentication with a single bill being used for both data and telephone services.
The present invention is a method of providing a user a terminal network address in a first network through which the user communicates with a data network, which preferably is a packet data network such as internet/intranet core, and authenticating connection of the user to the first network. A request is transmitted to at least one server in the first network to obtain the terminal network address in the first network which provides connection of the user to the data network and an identification of the user in the second network. In a first embodiment, the identification of the user is transmitted to the second network and authentication information of the user stored in the second network associated with the identification of the user is calculated using a user identification obtained from a user terminal smart card and transmitted from the second network to the first network. In second and third embodiments, the identification of the user and authentication information, which is the user""s profile in the second network, is stored in the first network. At least one advertisement of the terminal network address and information within the authentication information is transmitted from the first network to the user. The received at least one advertisement and the received information within the authentication information is processed and a determination is made if the authentication information is correct. A request message is transmitted from the user to the first network which selects a server to provide connection of the user to the data network and which requests configuration parameters of the first network, and authentication which is a function of a ciphering key and a signed response, which is a function of a secret parameter associated with a user and a random number contained in the received authentication information. A determination is made with the first network if the signed response is correct and if the signed response is correct, a reply to the user with the configuration parameters of the first network and an acknowledgment which is a function of the ciphering key is made. After the reply with the acknowledgment, which is a function of a ciphering key, communications between the user and the network are transmitted which may be authenticated with the ciphering key. In a preferred embodiment, the second network is a wireless network. The authentication information comprises a random number RAND, a signed response SRES which is a function of the random number, and a secret identifier of the user and the ciphering key Kc. Each transmitted communication, after authentication is complete, may contain an IPSEC authentication header or alternatively, may be encrypted and/or authenticated by encapsulating security payload (ESP). Authentication of the user in the first network is performed before providing the user with a terminal network address and typically before allowing the user access to the packet data network. When the second network stores the authentication information, a preferred storage is a register which stores information of the location of the mobile in the wireless network or using any alternative authentication encryption mechanism, e.g. radio link level security functions.